The basic function performed by many household kitchen appliances has remained the same for many decades. Cooktops, stoves, and ovens heat food in various ways using various heat generating components. While some basic aspects have remain largely unchanged, many of the systems associated with controlling the basic functions of these appliances has become more sophisticated. The control systems have been traditionally based on electro-mechanical components, such as timers, relays, and mechanical switches. As a result, electro-mechanical control systems are well known and have matured into a low cost technology. However, such systems are limited in their functionality and cannot be easily adapted to control new features without total system redesign.
The advent of low cost microcontrollers, typically costing a few dollars, can typically perform the function of several dedicated components and also provide the flexibility of allowing adapting the control system for new features as they are developed. Thus, use of microcontrollers is becoming prevalent in appliances. The ability to provide more features provides a marketing advantage that consumers may find useful by providing greater convenience, safety, and energy savings.
The microcontroller is essentially a microprocessor adapted for control type applications. Typically, the microprocessor incorporates circuitry for performing additional functions, such as enhanced I/O, control, and detection, frequently used in controlling a device. The incorporation of these functions avoids using additional components in conjunction with a microprocessor. However, whether a microprocessor or a microcontroller is used, each can be viewed as an equivalent to the other, to a certain degree, and, no distinction is intended between the two terms.
Various safety requirements are defined and documented by ANSI (American National Standards Institute), Underwriter's Laboratories (UL), or other industry safety groups pertaining to kitchen appliances, including cooktops, stoves, and ovens. One such safety requirement is that mechanisms must prevent the unexpected application of power to a heating element. For example, at least two user actions are required to turn on a heating element and in many implementations, a user may have to both depress a control knob while simultaneously turning the knob in order to activate a heating element. In contrast, turning off a heating element should require only one action (e.g., turning the knob without requiring any depression of the knob). These requirements are fulfilled by appropriately designed control valves or rotary switching designs.
However, other appliance designs involving a microcontroller typically use digital input devices, such as touch panels, keypads, switch inputs, etc. Thus, the traditional electro-mechanical control devices may not be present. In such embodiments, the safety requirement of receiving two user selections or actions to activate a heating element must be redesigned for a digital microcontroller environment.
Other safety requirements pertain to defining fail-safe modes of operation. A fail-safe mode of operation ensures that the failure of a single component in the appliance does not result in the appliance entering into an unsafe mode of operation. Thus, failure of a single device, such as the microcontroller, should not inadvertently result in a heating element being turned on. Similarly, when a heating element is on, failure of the microcontroller should not prevent the user from turning off the heating element.
Thus, regardless of the state of the appliance, failure of the microcontroller should not result in unsafe operation of the appliance. Because application of a microcontroller to control operation of the appliance provides greater flexibility, the possibility of microcontroller failure must be accounted for in each any every operating state of an appliance. Thus, even though solid state devices may be more reliable or have a longer life than analog electro-mechanical counterparts, defining all the fail-safe modes of operation can be complicated by using a microcontroller and needs to be designed into the system.
Once such strategy for achieving fail-safe operation has been to duplicate the microcontroller. This is disclosed in U.S. Pat. No. 6,201,997 entitled “Microprocessor System for Safety-Critical Control Systems.” That patent discloses two synchronously operated processors receiving the same input data and processing the same software (e.g., control program) in which comparators check the output signals of both processors and issue disconnecting signals in the event of non-correlation between the control signals of the two processors. In essence, a totally redundant microprocessor executing the same program is deployed and inconsistent signals from the two microprocessors is deemed to be a failure condition. It is not clear how the comparators can, without any intelligence, determine which processor is failing. This architecture requires each processor to be fully duplicated and execute the same exact control program. This can provide complexity to the control program as each type of failure condition must be accounted for. Further, a software bug in one processor will, by definition, also be present in the other processor. The use of dual microprocessors in this scheme does not necessarily enhance reliability or provide flexibility.
Another approach involving using multiple microprocessors is disclosed in U.S. Pat. No. 5,786,996, entitled “Appliance Control Circuit Comprising Dual Microprocessors For Enhanced Control Operation And Agency Safety Redundancy and Software Application Method Thereof. That patent discloses using dual microprocessors in a master-slave relationship where each processor receives the same user inputs, but where the processors are not executing the same control program. In one embodiment, the master microprocessor controls the system and communicates with the second microprocessor, which monitors safety functions. Each microprocessor controls a separate switch connected serially to a switch or relay, so that if either microprocessor opens the switch, power is removed from the heating element of the appliance. Thus, both microprocessors are required to be functional and generate signals in order for power to be applied to the heating element. The dual microprocessors must communicate with each other, typically every ⅛ of a second and must coordinate their processing of data. For example, the patent discloses that “the master transmitter will advise the slave transmitter/receiver whether the operator has pressed a key indicating a particular operation and whether the system is in a power up state.” (U.S. Pat. No. 5,786,996, col. 5, lines 61–64.) This type of communication requires coordination of timing between the two microprocessors as evidenced by the common zero-crossing timing input (line 46 of FIG. 2).
These references disclose using two microprocessors for enhanced safety and control. However, these references do not disclose an architecture where two or more microprocessors can be used, nor do they disclose an architecture using independent or semi-independent microprocessors. Specifically, they disclose microprocessors whose operation is coordinated and dependent on each other—either by running another microprocessor as an exact duplicate component (including the software), or a master microprocessor constantly communicating with a single slave microprocessor to constantly update status information. While this type of coordination may be easily accomplished if the entire system is designed and tested by one manufacturer, it is desirable for appliances to be modularized. This facilitates using replacement components and outsourcing the use of a component to different manufacturers. Ensuring proper operation between two tightly coupled master-slave processors can be difficult, particularly when designed and provided by different designers. Therefore, what is a needed is a modular control architecture allowing two or more microcontrollers to control operation of an appliance in which semi-autonomous operation is possible for each microcontroller in order to provide enhanced control and safety operation of the household appliance.